ci: add libstdc++ hardened-assertions leg to agent-check.yml

[ms609]

Fixes #60

What

Adds a glibcxx-assertions job to agent-check.yml that builds TreeSearch with PKG_CPPFLAGS=-D_GLIBCXX_ASSERTIONS and runs the full test suite. This catches container out-of-bounds address formation (e.g. vec[n] with n == vec.size(), no load or store) — the bug class from #51, which is invisible to plain builds, R CMD check, Valgrind, and ASan's own instrumentation (it watches accesses, not address arithmetic).

Blocking vs advisory — decided empirically

Built current origin/cpp-search locally with -D_GLIBCXX_ASSERTIONS and ran the full testthat suite (test_dir(..., load_package = 'installed'), mirroring how R CMD check runs tests, since a naive test_dir()/attach-only invocation hides internal .-prefixed test helpers and produces false failures — caught that trap before trusting the first run). Result: clean, EXIT=0, no assertion failures — only the usual extended-test skips and MaddisonSlatkin budget warnings, both pre-existing and unrelated to the flag. Landed blocking.

Flag placement, verified

PKG_CPPFLAGS, not PKG_CXXFLAGS — a ~/.R/Makevars can zero the latter (confirmed on the maintainer's own dev machine, which has exactly this). Verified the flag reaches the compiler two ways:

• The job itself asserts on the install log and fails if the flag never appears in a compiler invocation (grep -c ... -D_GLIBCXX_ASSERTIONS, exit 1 on zero).
• Manually inspected the GHA job log (run 31018253102, job libstdc++ hardened assertions): 34 compiler invocations carry -D_GLIBCXX_ASSERTIONS, e.g.

  g++ -std=gnu++17 ... -DNDEBUG -D_GLIBCXX_ASSERTIONS ... -c ts_hsj.cpp -o ts_hsj.o
  

Where

Added to agent-check.yml (workflow_dispatch-only, what agents already dispatch constantly) rather than a new workflow — fastest feedback, no new container/runner overhead. Runs independently of the existing ubuntu/windows jobs (no needs:) so it doesn't slow down or get gated by them.

Review round

An external-reviewer pass on the workflow diff found two real issues in the first version, both fixed here:

• The R CMD INSTALL ... | tee pipe swallowed a genuine install failure because the step had no explicit shell: bash (GHA's stepless default lacks pipefail) — added shell: bash to all run: steps.
• The new job shared ubuntu's dependency-cache key, so a hardened install could silently overwrite (or be overwritten by) the unhardened one across runs — bumped this job to its own cache-version.
  Also: extended (tier-3) tests weren't reachable via TREESEARCH_EXTENDED_TESTS, and the flag-count check errored past a missing log instead of failing closed — both fixed.

Re-dispatched after the fixes (run 31018253102) — all three jobs green, leg log again shows 34 flagged compiler invocations.

Verification

• Local: full suite clean under the flag against cpp-search tip.
• GHA (before fixes): run 31015124277 — all three jobs pass.
• GHA (after review fixes): run 31018253102 — all three jobs pass, flag confirmed in the compiler line.

No NEWS.md entry — CI-only change, not user-visible.